镜像站点 · 本页由第三方 GitHub 只读镜像提供，非 GitHub 官方站点，不接受任何登录或凭据输入。前往 github.com
Skip to content

deps: update github actions - #3907

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions
Open

deps: update github actions#3907
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions

Conversation

@renovate

@renovate renovate Bot commented Apr 20, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Pending
actions/cache (changelog) action digest d4323d4 → 0057852
actions/checkout action minor v4.2.2 → v4.4.0
actions/download-artifact (changelog) action digest cc20338 → d3f86a1
actions/github-script (changelog) action digest 60a0d83 → f28e40c
actions/setup-go (changelog) action digest f111f33 → 40f1582
actions/setup-node action minor v4.3.0 → v4.4.0
anchore/sbom-action action minor v0.18.0 → v0.24.3
aquasecurity/trivy-action action minor 0.30.0 → v0.36.0
docker/build-push-action action minor v6.15.0 → v6.19.2
docker/login-action action minor v3.3.0 → v3.7.0
docker/setup-buildx-action (changelog) action digest b5ca514 → 8d2750c
github/codeql-action action minor v3.28.11 → v3.39.2 v3.39.3
golangci/golangci-lint-action (changelog) action digest 4696ba8 → 55c2c14
googleapis/release-please-action action minor v4.2.0 → v4.4.1
helm/kind-action action minor v1.12.0 → v1.15.1 v1.15.2
ossf/scorecard-action action minor v2.4.0 → v2.5.0
sigstore/cosign-installer action minor v3.8.1 → v3.10.1
softprops/action-gh-release action minor v2.2.1 → v2.6.2

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

actions/checkout

v4.4.0

Compare Source

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v4.3.1...v4.4.0

v4.3.1

Compare Source

v4.3.0

Compare Source

actions/setup-node

v4.4.0

Compare Source

What's Changed
Bug fixes:
Enhancement:
Dependency update:
New Contributors

Full Changelog: actions/setup-node@v4...v4.4.0

anchore/sbom-action

v0.24.3

Compare Source

Added Features
Bug Fixes

(Full Changelog)

v0.24.2

Compare Source

Added Features
Additional Changes

(Full Changelog)

v0.24.1

Compare Source

v0.24.0

Compare Source

v0.24.0
⬆️ Dependencies

v0.23.1

Compare Source

v0.23.1
⬆️ Dependencies

v0.23.0

Compare Source

v0.23.0

v0.22.2

Compare Source

v0.22.2
⬆️ Dependencies

v0.22.1

Compare Source

v0.22.1
⬆️ Dependencies

v0.22.0

Compare Source

Changes in v0.22.0
⬆️ Dependencies

v0.21.1

Compare Source

Changes in v0.21.1

v0.21.0

Compare Source

v0.20.11

Compare Source

Changes in v0.20.11

v0.20.10

Compare Source

Changes in v0.20.10

v0.20.9

Compare Source

Changes in v0.20.9

v0.20.8

Compare Source

Changes in v0.20.8

v0.20.7

Compare Source

Changes in v0.20.7
  • chore(deps): update Syft to v1.34.1 (#​544)

v0.20.6

Compare Source

Changes in v0.20.6

v0.20.5

Compare Source

Changes in v0.20.5

v0.20.4

Compare Source

Changes in v0.20.4
  • chore: update Syft to v1.29.0 (#​529)

v0.20.3

Compare Source

Changes in v0.20.3

v0.20.2

Compare Source

Changes in v0.20.2

v0.20.1

Compare Source

Changes in v0.20.1

v0.20.0

Compare Source

Changes in v0.20.0
  • chore(deps): update Syft to v1.24.0 (#​522)

v0.19.0

Compare Source

Changes in v0.19.0
  • chore(deps): update Syft to v1.23.0 (#​521)
  • chore(deps): bump peter-evans/create-pull-request from 7.0.6 to 7.0.8 (#​519)
  • chore(deps): bump cross-spawn (#​514)
aquasecurity/trivy-action

v0.36.0

Compare Source

What's Changed

New Contributors

Full Changelog: aquasecurity/trivy-action@v0.35.0...v0.36.0

v0.35.0: Release: v0.35.0

Compare Source

This release is a duplicate of 0.35.0 which was not compromised.

As part of our response to the recent supply chain attack, we have migrated all tags to use the v prefix (e.g., v0.35.0 instead of 0.35.0). Going forward, all new releases will use the v prefix convention.

We have intentionally kept the 0.35.0 tag intact to avoid breaking existing workflows that depend on it.

If you are currently using 0.35.0, your workflows are safe — no action is required.

v0.34.0: Release: v0.34.0

Compare Source

Full Changelog: aquasecurity/trivy-action@v0.33.1...v0.34.0

v0.33.1: Release: v0.33.1

Compare Source

What's Changed

Full Changelog: aquasecurity/trivy-action@v0.33.0...v0.33.1

v0.33.0: Release: v0.33.0

Compare Source

What's Changed

New Contributors

Full Changelog: aquasecurity/trivy-action@v0.32.0...v0.33.0

v0.32.0: Release: v0.32.0

Compare Source

What's Changed

Full Changelog: aquasecurity/trivy-action@v0.31.0...v0.32.0

v0.31.0: Release: v0.31.0

Compare Source

What's Changed

New Contributors

Full Changelog: aquasecurity/trivy-action@v0.30.0...v0.31.0

docker/build-push-action

v6.19.2

Compare Source

Full Changelog: docker/build-push-action@v6.19.1...v6.19.2

v6.19.1

Compare Source

Full Changelog: docker/build-push-action@v6.19.0...v6.19.1

v6.19.0

Compare Source

  • Scope default git auth token to github.com by @​crazy-max in #​1451
  • Bump brace-expansion from 1.1.11 to 1.1.12 in #​1396
  • Bump form-data from 2.5.1 to 2.5.5 in #​1391
  • Bump js-yaml from 3.14.1 to 3.14.2 in #​1429
  • Bump lodash from 4.17.21 to 4.17.23 in #​1446
  • Bump tmp from 0.2.3 to 0.2.4 in #​1398
  • Bump undici from 5.28.4 to 5.29.0 in #​1397

Full Changelog: docker/build-push-action@v6.18.0...v6.19.0

v6.18.0

Compare Source

[!NOTE]
Build summary is now supported with Docker Build Cloud.

Full Changelog: docker/build-push-action@v6.17.0...v6.18.0

v6.17.0

Compare Source

[!NOTE]
Build record is now exported using the buildx history export command instead of the legacy export-build tool.

Full Changelog: docker/build-push-action@v6.16.0...v6.17.0

v6.16.0

Compare Source

Full Changelog: docker/build-push-action@v6.15.0...v6.16.0

docker/login-action

v3.7.0

Compare Source

Full Changelog: docker/login-action@v3.6.0...v3.7.0

v3.6.0

Compare Source

Full Changelog: docker/login-action@v3.5.0...v3.6.0

v3.5.0

Compare Source

Full Changelog: docker/login-action@v3.4.0...v3.5.0

v3.4.0

Compare Source

Full Changelog: docker/login-action@v3.3.0...v3.4.0

github/codeql-action

v3.39.2

Compare Source

  • Update default CodeQL bundle version to 2.27.4. #​4284
  • Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4266
  • Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #​4221
  • The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #​4243

v3.39.1

Compare Source

v3.39.0

Compare Source

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #​4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Vienna)

  • Branch creation
    • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
    • Only on Sunday and Saturday (* * * * 0,6)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner April 20, 2025 22:24
@github-actions github-actions Bot added the ops label Apr 20, 2025
@codecov

codecov Bot commented Apr 20, 2025 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.76%. Comparing base (40e195d) to head (2b98d90).

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #3907      +/-   ##
==========================================
+ Coverage   77.37%   77.76%   +0.38%     
==========================================
  Files         220      220              
  Lines       11708     9736    -1972     
==========================================
- Hits         9059     7571    -1488     
+ Misses       2281     1797     -484     
  Partials      368      368

see 154 files with indirect coverage changes

Flag Coverage Δ
certificate-operator 47.20% <ø> (-0.25%) ⬇️
component-tests 58.27% <ø> (+1.19%) ⬆️
lifecycle-operator 80.20% <ø> (+0.52%) ⬆️
metrics-operator 75.43% <ø> (+0.50%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate
renovate Bot force-pushed the renovate/github-actions branch 3 times, most recently from 679d7e4 to ea45ebb Compare April 27, 2025 21:54
@renovate
renovate Bot force-pushed the renovate/github-actions branch from ea45ebb to 7ffd86c Compare May 8, 2025 08:54
@renovate
renovate Bot force-pushed the renovate/github-actions branch 2 times, most recently from d3d56dd to 3cea30d Compare May 18, 2025 10:08
thschue
thschue previously approved these changes May 19, 2025
View reviewed changes

@thschue thschue left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 3cea30d to b15bd74 Compare May 30, 2025 18:13
@renovate
renovate Bot force-pushed the renovate/github-actions branch 3 times, most recently from 2923d4f to e6d83b6 Compare June 13, 2025 22:08
@renovate
renovate Bot force-pushed the renovate/github-actions branch 5 times, most recently from f263292 to 36c4a51 Compare June 20, 2025 17:10
@renovate
renovate Bot force-pushed the renovate/github-actions branch 3 times, most recently from 0008bf7 to 05a1203 Compare July 3, 2025 16:15
@renovate
renovate Bot force-pushed the renovate/github-actions branch 2 times, most recently from 5184f42 to 3a0ee3c Compare July 7, 2025 06:56
@renovate
renovate Bot force-pushed the renovate/github-actions branch 3 times, most recently from 47c3007 to f1d2393 Compare July 24, 2025 13:07
@renovate
renovate Bot force-pushed the renovate/github-actions branch 4 times, most recently from 68ba8ca to c5c29b9 Compare September 13, 2025 23:04
@renovate
renovate Bot force-pushed the renovate/github-actions branch 2 times, most recently from e616e73 to b1a2402 Compare September 18, 2025 23:04
@renovate
renovate Bot force-pushed the renovate/github-actions branch 3 times, most recently from 3f35970 to 583a15d Compare September 29, 2025 22:15
@renovate
renovate Bot force-pushed the renovate/github-actions branch 3 times, most recently from d0d54e2 to 227185f Compare October 6, 2025 21:27
@renovate
renovate Bot force-pushed the renovate/github-actions branch 4 times, most recently from 7b42754 to 2e49449 Compare October 14, 2025 16:44
@renovate
renovate Bot force-pushed the renovate/github-actions branch 4 times, most recently from 3c9e578 to 711a7e9 Compare October 20, 2025 23:04
@renovate
renovate Bot force-pushed the renovate/github-actions branch 4 times, most recently from c9fe1c1 to de9d7c3 Compare November 2, 2025 12:52
@renovate
renovate Bot force-pushed the renovate/github-actions branch 2 times, most recently from 0361add to e9f8c6e Compare November 6, 2025 15:44
@sonarqubecloud

sonarqubecloud Bot commented May 4, 2026

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
1 Security Hotspot
E Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

@sonarqubecloud

sonarqubecloud Bot commented May 11, 2026

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
1 Security Hotspot
E Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

@renovate
deps: update github actions
2b98d90 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@sonarqubecloud

sonarqubecloud Bot commented Nov 6, 2026

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@thschue thschue thschue left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies github_actions ops

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@thschue